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We introduce the distribution of a secret multipartite entangled state in a real-world scenario as a quantum 
primitive. We show that in the presence of noisy quantum channels (and noisy control operations) any state 
chosen from the set of two-colorable graph states (CSS codewords) can be created with high fidelity while it 
remains unknown to all parties. This is accomplished by either blind multipartite entanglement purification, 
which we introduce in this paper, or by multipartite entanglement purification of enlarged states, which offers 
advantages over an alternative scheme based on standard channel purification and teleportation. The parties are 
thus provided with a secret resource of their choice for distributed secure applications. 
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I. INTRODUCTION 

In classical information theory a number of basic primi- 
tives are known — among them bit commitment, coin tossing, 
fingerprinting, Byzantine agreement and key distribution — , 
which serve as building blocks for practically relevant appli- 
cations. Several of these classical primitives have also been 
investigated in a quantum set-up. It was shown that quantum 
features allow one to perform certain tasks apparently impos- 
sible in a classical set-up, the most prominent example being 
(quantum) key distribution, which allows for unconditional 
secure communication. The quantum nature of states offers, 
however, not only additional possibilities to realize classical 
primitives, but also allows us to consider new primitives that 
are intrinsically quantum and hence do not have a counterpart 
in classical information theory or classical physics. An im- 
portant aspect of such quantum primitives — which has been 
mostly neglected in previous discussions — is the stability of 
these concepts under imperfections, i.e. the realization of the 
task in a real-world scenario. A task that might seem triv- 
ial in an idealized scenario may become highly non-trivial or 
even impossible under realistic conditions, i.e. when taking 
inevitable noise in quantum channels and local control oper- 
ations into account. We emphasize that noise is not just a 
practical issue, but is a fundamental Umitation one has to cope 
with in quantum systems. 

In this paper, we will discuss a robust quantum primitive, 
which may be used as a basic building block for both quan- 
tum and classical security applications in situations where lo- 
cal and channel noise are present. Specifically, we will con- 
sider the secret creation of a spatially distributed multipar- 
tite entangled state with high fidelity. We will consider the 
set of all two-colorable graph states as possible target states. 
Two-colorable graph states include many qualitatively dif- 
ferent types of multipartite entangled states, each of which 
can serve as a different resource to perform certain security 
tasks. In particular, they include any collection of bipartite 
singlet states shared between some of the parties, any type 
of multipartite GHZ states, so-called cluster states fV, Ol] (a 
universal resource for measurement based quantum compu- 
tation) as well as algorithmic specific resources which allow 
one to implement a certain algorithm (or non-local unitary 



operation) by means of measurements. As has been shown 
recently, two colorable graph states are equivalent to code- 
words of Calderbank-Shor-Steane (CSS) codes j3|. It may 
be of interest to the end-users that the state remains secret 
to any third party, i.e. nobody else knows which specific re- 
source they share (and hence which tasks they are capable to 
perform). The information about the state can even remain 
unknown to the parties themselves, being only disclosed to a 
single end-user ( e.g. a trusted party or dealer). This is rele- 
vant in the implementation of distributed secure quantum ap- 
plications over noisy communication channels, which count 
with an additional 'adversary', the eavesdropper (that should 
be considered as the noise source in the channel), and that 
might collaborate with the untrustful parties. There are stan- 
dard purification protocols |3> S S la. S S lal used to reduce 
noise levels and factor out any possible eavesdropper even in 
the presence of noise LlQl . However, these protocols can not 
straightforwardly be accommodated to account for possible 
untrustful parties — which actively participate in the purifica- 
tion protocol — , and for their possible complicity with eaves- 
dropper. 



In this paper, we present ways to achieve the secure dis- 
tribution of the aforementioned graph states under realistic 
conditions, i.e. noisy quantum channels and imperfect local 
control operations. After fixing notation and describing the 
scenario for secret state distribution in Sec. [H] we present 
three possible solutions to the problem in Sec. [Ill] The first 
approach, described in Sec. 



nil Al is based on channel purifi- 
cation and teleportation, while the second and third approach 
deal with direct multipartite entanglement purification. The 
second approach, described in Sec. HUB I uses blind multi- 
partite entanglement purification, which we introduce in this 
paper In the third approach (see Sec. IIII C> , the security is 
guaranteed by purifying an enlarged entangled state. We sum- 
marize and conclude in Sec. II VI 
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II. DEFINITIONS AND DESCRIPTION OF THE 
SCENARIO 

A. Two-colorable graph states 

We start by defining two-colorable graph states. A graph 
G, given by a set of N vertices {1,2,..., iV} connected in 
a specific way by edges E, is called two-colorable if there 
exists two groups of vertices, A,B such that there are no edges 
inside either of the groups, i.e. {fc, 1} ^ E if k,l € A or 
k,l £ B (see Fig. 0. To every such graph there corresponds a 
basis of iV-qubit states {l/i,)^}, where each of the basis states 
\ij)g is the common eigenstate of N commuting correlation 
operators K'^ with eigenvalues (— 1)^^, = fii^2 ■ ■ ■ I^-n- 
That is, they fulfill the set of eigenvalue equations Kj^\fi)G ~ 
(— j = 1, . . . , A^. The correlation operators are 
uniquely determined by the graph G and are given by 

{fcj}6-E 

where a = x [a = z] if j lE A[j £ B] respectively and 
denotes the application of the corresponding Pauli operator by 
party k. Note that the so-defined graph states are identical to 
the usual graph states, as introduced in fS] and e.g. used in 
Ref. 181 19(], up to local Hadamard operations performed on 
all particles in B. As has been shown recently ||3| they are 
in fact equivalent to codewords of the CSS codes. We also 
remark that the correlation operators {Kj} are the generators 
of a group which is often called stabilizer of the state |0)g, 
and the corresponding description in terms of the stabilizers is 
also referred to as the stabilizer formalism. 

We will also consider mixed states p, which for a given 
graph G can be written in the corresponding graph state basis 
{l/x)^}, p = J2fi V ^^ifAi*) ('^l- We will often be interested in 
fidelity of the mixed state, i.e. the overlap with some desired 
pure state, say |0)g, F = (0|/9|0). 




FIG. 1 : Examples of two-colorable graphs which correspond to (a) 
GHZ state; (b) linear cluster state; (c) two-dimensional cluster state. 
Vertices with same color are not connected by edges. 



B. Description of scenario 

We consider a central party C (the company), which is con- 
nected via noisy quantum channels to TV spatially separated 
local agents Aj, j S {1, 2, . . . , N}. The company offers the 
service to spatially separated customers to deliver upon re- 
quest any multipartite entangled state chosen from the set of 
two-colorable graph states, specified by the graph G and the 
(basis) index /x, with chosen fidelity F ~ 1 — e. The state 
is delivered by the local agents Aj to the end-users Ej. The 
company guarantees as a special security service that the local 
agents, a potential eavesdropper, or any other party different 
than the one who placed the order cannot learn any informa- 
tion about the chosen state. 



III. SECRET STATE DISTRIBUTION: POSSIBLE 
SOLUTIONS 

We remark that in the case of noiseless quantum channels 
between C and the local agents, the described task can be triv- 
ially achieved by creating locally at C a single copy of the re- 
quested state and distributing it to the local agents. The single 
copy does not allow the local agents and a potential eaves- 
dropper to learn information about the graph G, even if they 
decide to cooperate and perform measurements. This follows 
from the fact that the basis index fi is unknown and random 
from the point of view of the local agents, which implies that 
for any chosen graph G the ensemble of states forms 
the identity and ensembles corresponding to different graphs 
G are hence indistinguishable. However, if (as in a realistic 
scenario) the quantum channels connecting the central station 
C with the local agents Aj are noisy, the task becomes non- 
trivial. In this case, the state obtained by the local agents pA 
will be mixed and the fidelity will be below the desired one. 

Realistic applications must be designed to cope with two 
sources of errors, namely noisy channels and noisy local oper- 
ations. It is well known that problems arising from the noisy 
channels can be overcome using entanglement purification. 
In a multi-partite scenario we will thus opt for one of the fol- 
lowing approaches depending on the particular conditions (see 
Fig. 13: 

(i) Channel purification (see Sec. IIII A> : The channels it- 
self may be purified. This can be accomplished by send- 
ing parts of maximally entangled singlet states through 
each individual channel from C to Aj and creating from 
the resulting multiple copies of the noisy bipartite en- 
tangled states a few copies with high fidelity by a se- 
quence of local operations and classical communica- 
tion (LOCC), e.g. using one of the entanglement pu- 
rification protocols of Refs. 0,13]. This high-fidelity 
entangled states can then be used for teleportation lllll 
and serve as a purified channel, thereby allowing for the 
distribution of arbitrary multipartite entangled states. 

(ii) Direct multiparty entanglement purification (see Sec. 
IIIIB> : The resulting multipartite mixed states pA can 
be purified. That is, several copies of the multipartite 
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mixed states pA are produced by distributing the locally 
created graph state through noisy channels to the local 
agents Aj. A suitable sequence of LOCC, e.g. the pu- 
rification protocol for two-colorable graph states intro- 
duced in Ref. 1^, allows us to create few copies with 
(arbitrary) high fideUty. 

(iii) I'urification of enlarged states (see Sec. lIIICV One can 
purify an enlarged entangled state, i.e. a (graph) state 
that is entangled with additional particles that are kept 
at the central station, while the remaining particles are 
sent through the noisy channels. The resulting mixed 
state pAC is purified by means of direct multipartite en- 
tanglement purification as in (ii), and the desired state 
shared among the parties Aj can be created from the pu- 
rified state (ideally given by |^ac)) by means of local 
measurements in C. 




FIG. 2: Set-up for secure distribution of multipartite entangled states 
based on (a) Channel purification (i); (b) direct purification of mul- 
tipartite entangled states (ii); (c) purification of enlarged entangled 
states (iii). 

On top of the noise from channels, there is also noise in 
the local control operations. In this case, it turns out that en- 
tanglement purification is still possible, although the minimal 
required fidelity F^in (i-C- the maximal acceptable channel 
noise) as well as the maximal reachable fidelity i^max of the 
purified states is limited by the amount of noise in the local 
control operations |^ Hill and in fact strongly depends on 
the entanglement purification protocol that is used. It was 
shown in Ref. f9| that direct multipartite entanglement pu- 
rification offers advantages over protocols based on bipartite 
purification. In particular, for graph states of small degree 
and a generic noise model for local operations, the reach- 
able fidelity for multipartite states created by bipartite entan- 
glement purification (i.e. channel purification) and telepor- 
tation turns out to be smaller than the fidelity of the states 
created by direct multipartite entanglement purification, i.e. 
-Fmax > i^max > i^max- This is truc for all valucs of the local 
noise (see Fig. 7 in f9|l). The upper fixed points i^,„ax only 
depend on noise in local control operations and on the entan- 
glement purification protocol. On the other hand, the mini- 
mal required fidelity Fmin (which again depends on the pu- 
rification protocol and noise in local control operations) puts 
limits on the maximal acceptable channel noise. The mini- 
mal required fidelity Fmin fulfills for uncorrected channels 



-^min < '^min'' < ^min' whilc in the casc of Correlated chan- 
nels the situation can also be the other way around. In general, 
each of the three schemes (i-iii) has its own advantages. There 
are parameter regimes (noise level of local operations, channel 
noise) for which a certain scheme allows one to create an en- 
tangled state with sufficiently high fidelity, while the other two 
schemes fail. In particular, it can happen that a multipartite 
state cannot be produced with required fidelity F = 1 — e as 
requested by customers when using method (i), while a proto- 
col based on direct multipartite entanglement purification (ii) 
or (iii) enables one to reach the required fidelity. These facts 
are our main motivation to provide alternative methods to (i) 
to accomplish the secret creation of a multipartite entangled 
state, that are based on direct multiparty entanglement purifi- 
cation. 



A. Channel purification 

For perfect local control operations, approach (i) immedi- 
ately leads to a protocol to create arbitrary multipartite entan- 
gled states with high fidelity in such a way that local agents 
and possible eavesdroppers do not learn any information about 
the created state. The purification of the channel does not 
contain any information about the state, and the presence of 
eavesdroppers can be excluded by checking the resulting sin- 
glet states (e.g. by testing violation of Bell's inequality or, 
simpler, by measuring the expectation values of the correla- 
tion operators (Kj), j ~ 1, . . . , A^) fisll . After successful 
teleportation the local agents only possess a single copy of 
an unknown state in a random basis. Again, as in the case 
of noiseless channels, the ensembles corresponding to differ- 
ent graphs G are indistinguishable. The teleportation process 
may even be postponed until the local agents deliver (several 
copies of) the purified singlets to the end-users (who may then 
check themselves the validity of the singlets together with C 
by testing a random subset) before teleporting the requested 
multipartite state. This circumvents any possible attempts of 
the local agents or eavesdroppers to learn information about 
the state or to corrupt the delivered state at a later stage. Secu- 
rity requirements are fulfilled even in the presence of imper- 
fect control operations, as no information regarding the finally 
distributed state can be learned. 



B. Direct multipartite entanglement purification 

We now turn to the second scenario (ii), the direct purifi- 
cation of noisy multipartite entangled states, namely two- 
colorable graph states. For simplicity of the analysis, we con- 
sider in the following noiseless local operations. This restric- 
tion is, however, not crucial and will in fact be dropped later 
on. We start by summarizing the main steps involved in any 
multipartite purification protocol Ql^l" (i) Depolarization of 
the mixed state p to standard form pQ diagonal in the basis 
of entangled states to be purified; (ii) Local operations on two 
(or more) copies of the state pQ in such a way that informa- 
tion about the first state(s) is transferred to the last one; (iii) 
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Measurement of the last state to retrieve this information, pub- 
lic announcement of the measurement outcomes, and keeping 
or discarding the remaining states depending on the measure- 
ment outcomes. 

It is easy to see that information about the state | /x) g to be 
purified, both about the graph G and the used basis /x, can be 
learned in various ways by all local agents involved in such a 
protocol. In the depolarization process (i), elements of the sta- 
bilizer of\n)c (all possible products of correlation operators 
Kf) are applied SMI^li which reveal information about the 
graph G. The local operations and measurements performed 
in the second step provide knowledge about the structure of 
the graph. For example, in the recurrence protocol of Ref. 
10] the two-coloring of the graph is revealed. The informa- 
tion about the measurement outcomes together with the fact 
that a particular outcome is interpreted as a successful step 
also allows the parties to obtain information about the graph. 
The statistics of measurement outcomes in several steps of the 
protocol can be used to learn both G and /i, as for all possible 
graphs the expectation values of can be calculated and 
the corresponding histograms can be analyzed. Finally, since 
in principle a large number of copies of the state are avail- 
able, (some of) the local agents can decide to perform state 
tomography on a sub-ensemble, thereby learning all informa- 
tion about the state they should purify. That is, when using any 
(known) direct multiparticle entanglement purification proto- 
col, the secrecy of the state to be purified is not guaranteed. 



1. Blind purification 

In the following we will present a modified multipartite en- 
tanglement purification protocol where it is impossible for all 
involved local agents to learn any information about the state 
being purified, even if all of them decide to collaborate and 
even if they conspire with a possible eavesdropper who is in 
full control of all quantum channels between C and Aj . The 
central station G coordinates the action of the local agents 
and is the only party (besides the customer that placed the or- 
der) that knows the graph state which is being purified. The 
customers' order consists in the graph G and the desired ba- 
sis index /x, as well as an additional secret random bit string 
of suitable size lfl4ll . After receiving the order, the central 
party prepares M two-colorable graph states corresponding 
to the graph G and chooses the basis indices \mi)Q randomly 
from a uniform distribution. For any graph G the set of graph 
states is complete, i.e. |m)G'('m.| = 1. This implies 

that the completely mixed ensemble of states corresponding 
to two different graphs Gi and G2, {\'mi)Gi}i=i.2....M and 
{|'TT'i)G2}i=i,2...,A/, are indistinguishable, as the correspond- 
ing density operator (i.e. the proper description of the ensem- 
ble for any observer not possessing the information about mi) 
is the completely mixed state (ocl) 1 15]. The states \mi) are 
then distributed through noisy channels to the local agents Aj . 
Purification of these states takes place by a protocol (see be- 
low) where no information about the indices mi or the graph 
G is revealed, which ensures that at any stage of the proto- 
col the ensemble of states corresponding to different graphs 



remain indistinguishable by the local agents. Finally the state 
|/i)G is delivered to the end-users. 

The first step in the purification protocol is to ensure that 
the mixed state p — which arises after sending the state |m)G 
through the noisy channels £1,82, ■ ■ ■ ,£n — is diagonal in 
the specific graph state basis {In)^}. In standard purifica- 
tion protocols this is enforced by depolarizing the transmit- 
ted state. Instead, here we depolarize the channels £j to a 
Pauli-diagonal form |3- This can be accomplished by ap- 
plying probabilistically the operators ai [af] before [after] 
sending a particle through the channel in a correlated way 
(here {(7i}i=o,...,3 = {^,o'x,o'y,<^z})- Given a general ini- 
tial channel £p = J2i j=o ^ij'^iP'^j the resulting depolarized 

channel £ is then given by £p = J2^=o ^jj'^jP'^j- More- 
over, the action of a Pauh operator in party Ak on a graph 

state results in another graph state: ct''^'''' |m)G(m|(Tj-"^'"'' = 
\m © nf)G{'m(Bnf\, where nf depends on the neigh- 
borhood of particle Ak specified by the graph G 0]. That 
is, sending \m)G through the depolarized channels also re- 
sults — independently of the graph G — in the creation of a 
graph-diagonal state in this specific graph state basis ITtIi . 
Additionally, by writing \m)G = cr^^cr^^|0)G — where 
m = {mA,mB) and cr["'* denotes the action of ai on all 
parties j E A for which rrij = 1, we find that if 

po = £1 . . .£n\0)g{0\ =J2^r.\n)G{n\, (2) 

n 

is the state resulting from sending \0)g through the channels, 
then the resulting state pm when sending a different basis state 
\m)G, is given by a simple basis shift of po, i.e. 

Pm.=£i- ■ ■£N\'m)G{m\ = ^ Xn\n ® m)G{n ® m\. (3) 

n 

These are non-trivial properties of states diagonal in a graph 
state basis that follow from the description of these states in 
terms of their stabilizers and from the commutation relations 
of the Pauli matrices. At this stage the local agents Aj thus 
share the M states {pmi}i=i....,M ITsll . 

We now introduce modified multipartite recurrence proto- 
cols PI', P2' that give the same performance as the protocols 
PI, P2 of Ref. ]0,|3], but operate on states pm, Pn (which are 
obtained by a basis shift from pQ according to Eq. |3} and fulfill 
our security requirements. We start with protocol PI', where 
in a first step local CNOT operations Ill9ll with the particles 
of the first [second] state acting as source [target] respectively 
are applied by all parties. It is easy to check that the action of 
such multilateral CNOT operations is given by 

\mA,mB)\nA,nB) |mA, n^) jm^ ® n^, ns).(4) 

All particles of the second state are then measured in the 
eigenbasis {|0)i,, \l)x} of ax, yielding results (—1)^* which 
are publicly announced. From the expectation values of all 
correlation operators Kj with j G A can be calculated at the 
central station G. The result is taken as a successful purifi- 
cation step if the calculated expectation values correspond to 
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ruA © TiA- In this case, one finds that the resulting state is 
again diagonal in the graph state basis, with new coefficients 

^-fA'S)mA.~fB(BrnB(BnB ~ 

{( l/B , (J,B ) I I'B B =-)'£> } 

where if is a normalization constant. Note that these coeffi- 
cients are exactly the same as in the situation where we apply 
the original protocol PI to two copies of pQ, only the ba- 
sis of the resulting state is shifted by {mA^rnB (B tib) (as 
done in Eq. O. Similarly, the protocol P2' consists of local 
CNOTs in the opposite direction, followed by measurement of 
all particles of the second state in the eigenbasis {\Q)z, \^)z} 
of (Tz ■ From the measurement outcomes the expectation val- 
ues of all correlation operators Kj, j e B can be calculated 
at the central station C. The result is interpreted as a suc- 
cessful step if the calculated expectation values correspond 
to TUB ® TiB- Again, one can determine the action of this 
protocol on two states pm (8) Pn and finds that the resulting 
state is up to a basis shift (m^ © n^, ms) the same as the 
one obtained by the protocol P2 applied to pg ^. The pu- 
rification procedure takes place by an alternating application 
of protocols PI', P2', where at each step the central station 
randomly chooses the pairs to combine. In particular, also 
pairs resulting from unsuccessful purification rounds are fur- 
ther processed. We remark that this substantially reduces the 
yield of the entanglement purification protocol as compared to 
the original scheme. The reachable fidelity and error thresh- 
olds, however, are exactly the same as of protocols P1,P2 
investigated in Ref. |8, 9]. The only difference to the original 
scheme for the central party C is that it has to keep track of the 
basis shift for each state and modify the decision about suc- 
cessful/unsuccessful purification steps (which are not publicly 
announced) accordingly. We remark that in order to deter- 
mine the basis shifts for final copies, knowledge of the initial 
basis shifts {irii} and the history of the purification proce- 
dure is required for each state, i.e. ni = fi{mi). At the end 
of the procedure, additional independent random basis shifts 
are applied to all states (this can be accomplished by letting 
the local agents apply appropriate Pauli operators), where for 
a specific copy, say 1, resulting from a successful purifica- 
tion branch (i.e. all purification steps successful) a basis shift 
ni © /X is performed. This guarantees that copy 1 is in the 
basis and hence corresponds to the required state. The or- 
der of the copies is randomly chosen by C in such a way that 
copy 1 is located at position specified by the additional se- 
cret bit string which is shared with the end-users. All states 
(also the ones resulting from unsuccessful purification steps) 
are then handed over to the end-users. This ensures that it re- 
mains unknown to all involved parties (except G and the end- 
users) which of the copies correspond to successful branches. 
Finally, all states but copy 1 are measured, either in the eigen- 
basis of ax or az and the measurement results are publicly 
announced. This allows the central station to check the trust- 
fulness of the local agents, as e.g. for states corresponding to 
a successful purification procedure the expectation values of 
the correlation operators and hence the fidelity of the pro- 



duced states can be determined by C fisll . Depending on the 
results of this verification procedure, C uses another shared 
random bit to secretly announce whether the remaining copy 
can be used for the desired security application. We note that 
distrustful local agents or eavesdropper can always prevent a 
successful generation of the desired state, e.g. by simply not 
taking place in the purification procedure as requested or by 
adding additional noise. However, if the state passed the veri- 
fication procedure it can be guaranteed that it has the required 
fidelity and that the local agents have not learned information 
about the target state. 



2. Security of direct multiparty entanglement purification 

We now discuss the security of this modified protocol by 
analyzing the scheme from the point of view of the local 
agents (or eavesdropper). We first remark that the entangle- 
ment purification protocol is carefully constructed in such a 
way that absolutely no information about the state to be puri- 
fied is revealed during the protocol. In contrast to original pro- 
tocols PI, P2, the protocols are symmetric, i.e. no informa- 
tion about the two-coloring of the graph is revealed. The ran- 
domly chosen basis states {mi\ guarantees that at any stage 
of the protocol no information about the structure of the graph 
can be learned from measurement statistics, as any statistics 
is randomized due to random basis shifts. Even the informa- 
tion of whether a given purification step is successful or not is 
kept secret. This is guaranteed on the one hand by randomly 
combining copies of the state after each purification round and 
on the other hand by delivering the whole ensemble of states 
rather than a single copy (which the local agents would oth- 
erwise identify as the resulting state of several successful pu- 
rification rounds). Although it seems unlikely that such a tiny 
amount of information could be used by the local agents and 
eavesdropper to learn about the identity of the graph state, it 
can not be excluded that there exists a strategy which allows 
them to make use of this information. One may e.g. imag- 
ine that by means of a graph state analyzer they were able to 
learn information about the basis index for this specific 
state, which — together with the information that the state re- 
sults from several successful purification rounds — could then 
be used to exclude the graphs that are incompatible with the 
measurement outcomes obtained in the purification protocol. 
Hence, we have modified the purification protocol in the way 
described above, which guarantees that no additional infor- 
mation can be learned from the protocol itself. In fact, from 
the point of view of the local agents the protocol they should 
perform (as well as all measurement outcomes etc.) is the 
same for all graph states. It follows that the secrecy of the 
graph state to be purified is still guaranteed by the fact that 
the corresponding ensembles of states for two different graph 
states are indistinguishable, as they are both described by the 
identity. Naturally, this still holds if one considers the trans- 
mitted ensemble of states {prm} instead of {m,i}: it is safe 
to attribute the noise in the channel to the actions of an eaves- 
dropper and/or the agents. 

We finally remark that unconditional security can only be 
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guaranteed if we keep the information whether the required 
state has been successfully created or not secret. Otherwise 
there exists an (indirect) strategy for a possible eavesdropper 
to learn about the graph: by varying the noise in the channel 
(we assume that Eve has complete control over the channel). 
Eve together with the local agents can prevent the purifica- 
tion of certain states (e.g. states with high degree) as for these 
states the channel noise (or noise in local control operations) 
is above the threshold value where purification is possible. As 
the threshold values depend on the graph, knowing whether 
the purification procedure was successful or not, would pro- 
vide Eve with some information about the graph, e.g. about 
its (local) degree. This is just a single bit of information which 
might well be negligible in many cases as there exist exponen- 
tially many different graph states which are potential target 
states. By keeping the information of whether the procedure 
was successful or not secret, we prevent Eve from learning 
even this single bit of information. The validation stage in our 
protocol only serves to detect possible attempts of the local 
agents to prevent the production of the state with required fi- 
delity. The secrecy of the states is guaranteed by other means 
(the random basis shifts). In principle, one may use the val- 
idation stage also to detect possible attempts of Eve or the 
local agents to gain information about the final graph, which 
clearly leads to corruption of the states and hence to reduced 
fidelity. In approach (iii) we will discuss a strategy which 
guarantees security even when the success or failure of the 
protocol is publicly known. The strategy of (iii) can immedi- 
ately be adopted to the protocol described above. 



The influence of noisy local operations can easily be ana- 
lyzed. From the point of view of the central station C, we 
essentially have entanglement purification protocols P1,P2 
with imperfect means with the corresponding properties dis- 
cussed in Refs. fil^^. In particular, entanglement purification 
is still possible even for errors of local operations at the order 
of (several) percent. Only the the reachable fidelity of the tar- 
get state is limited. From the point of view of the local agents, 
the additional noise in their operations will not enable them 
to learn more information about the state to be purified than 
they would be able to learn if their operations are noiseless 
(they still would have to distinguish between two ensembles 
of states which are both — from their point of view — the iden- 
tity at all stages of the protocol). Thus the produced state re- 
mains secret and the required procedure can be followed in a 
real-world scenario. The secrecy of the states at all stages is 
guaranteed by the random basis shifts {rrii}, which on the one 
hand ensure that the input ensemble is the maximally mixed 
state, and on the other hand that measurement statistics and 
any association of specific outcomes with the graph-structure 
during the protocol itself are randomized. The second state- 
ment follows from the non-trivial property of two-colorable 
graph states that basis shifts can be effectively propagated 
through both the channels and the purification protocols, re- 
sulting in output states with shifted bases. 



C. Purification of enlarged states 

We now turn to scenarion (iii), the purification of enlarged 
states. Instead of creating the desired graph state | /x) q directly 
and sending several copies through the noisy channels to the 
local agents, the central station can also create enlarged graph 
states |0)q of 2N qubits in such a way that each vertex of the 
initial graph is connected to an additional, independent vertex. 
That is, if G = {V, E) is the graph of vertices {1, 2, . . . , TV}, 
then the graph G corresponding to the enlarged state is given 
by vertices {1,2,..., 2iV} with edges E ^ E\J {{k,k + N)} 
with k ~ 1,2, . . . , N. The qubits corresponding to vertices 1 
to N are sent through the noisy channels to the local agents, 
while qubits + 1 to 2 are kept by the central party C. The 
bases randomization of initial states done in approach (ii) is 
here replaced by additional quantum correlations between C 
and Aj . In principle, C could introduce random basis shifts 
on the states of Aj by performing suitable measurements (re- 
ducing the protocol to the one discussed in (ii)). However, the 
quantum correlations are more powerful than classical corre- 
lations, which allows us to further simplify the purification 
protocol. The purification takes place by a multipartite pro- 
tocol and hence offers advantages (e.g. higher reachable fi- 
delity) as compared to scheme (i) based on channel purifica- 
tion. When compared to scheme (ii), one finds a higher ro- 
bustness of the states against channel noise for uncorrelated 
channels. It is easy to check that the state |0)q can be written 
as 

l°^G = 7=El"^)G®|m), (6) 

where |m)G is a graph state corresponding to graph G of par- 
ticles 1 to N, while |m) = \m1m2 ■ ■ ■ m-Ar) with nij E {0, 1} 
are orthogonal product states of particles TV + 1 to 2N and 
the sum runs over all possible binary vectors m. We have that 
\mk) denotes the eigenstate with eigenvalue (— l)™*: of the 
operator (j^ if k G A [a^ if /c G i?], where A,B correspond to 
the two-coloring of the graph G. 

The resulting noisy graph states are then purified using 
multipartite entanglement purification protocols PI', P2' de- 
scribed above, which can be applied because the graph G is 
two-colorable whenever the initial graph G is two-colorable. 
While the local agents publicly announce their measurement 
outcomes, the central party G keeps its measurement out- 
comes secret. The expectation value of each correlation op- 
erator Kj — which determine whether a purification step is 
successful or not — depends on the measurement outcome in 
particle j and its neighbors. For 7 > TV, particle j itself is held 
by C, while for j < TV the neighboring particle (j+N) is held 
by C, which implies that the expectation value of Kj Vj can 
not be determined by the local agents. The additional qubits 
held at G act as randomizer for all measurement outcomes of 
the local agents. After several successful purification rounds 
(where in this case always two pairs resulting from a success- 
ful purification round can be combined), all but a single copy 
is measured in eigenbasis of (j^ or (j^, where again only the 
measurement outcomes of local agents are announced. From 
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the measurement outcomes, C can calculate expectation val- 
ues for the correlation operators Kj and hence verify whether 
the required fidelity of the states was achieved. If the states 
passed the validation step, i.e. the required fidelity is achieved, 
the local agents hand the particles of the remaining copy over 
to the end-users. Finally, all qubits in C of the remaining 
copy are measured in the eigenbasis of ct^ [a^] if they are in 
A [B}, where A, B corresponds to the two-coloring of the 
graph G. If the final states were pure, i.e. |0)q, it follows 
from Eq. |5]that for measurement outcome corresponding to 
m = mim2 ■ ■ ■ mjy with trij G {0, 1}, the resulting state 
shared by the end users would be given by \m)G. Announc- 
ing publicly the bit string mS) /j, allows the end-users to shift 
the basis such that they finally hold the state \ij.}g- Note that 
m /X is a random string from the point of view of local 
agents and an eavesdropper, and does not contain informa- 
tion since /j, is secret. We consider now the case where the 
final state is mixed, i.e. = A^^ where 
corresponds to vertices 1 to (i.e. the particles held by 
the local agents), while v refers to vertices + 1 to 2N (i.e. 
the particles held by C). In the case where the outcome of 
all measurements is (+1), we have that the state after the mea- 
surements in C is given by 

'^o = E(EV)I/^)g(m|, (7) 

while for other measurement outcomes m the basis is shifted 
by m, i.e. we obtain pm- Note that the fidelity G{'m\Pm\'m)G 
with respect to the graph state corresponding to the graph G 
is larger than the fidelity of the initial (enlarged) state with 
respect to the graph state |00)g, which is given by Aqq. 



1. Secturity of purification of enlarged states 

We now discuss the security of this protocol. We have that 
the reduced density operator of particles 1 to A^ held by the 
local agents (or an eavesdropper) is given by \m)G{m\ 
which is the identity for any graph G. This implies that even 
if several copies of the state are available to the local agents, 
they are not able to distinguish between different graphs. In 
fact, the state \Q)q (Eq. |6j is maximally entangled between 
systems C and the local agents. This implies that by an ap- 
propriate unitary operation in C, one can change the sub- 
graph G in y4 to any other sub-graph G' . This can be seen 
from the fact that for a maximally entangled state |<I')cA, 
(g) = Ia^Ua]^)- In other words, C has in prin- 

ciple the freedom to change the delivered state until the last 
moment i.e. after the last copy is delivered to the end-users, 
which clearly makes it impossible for the local agents or any 
eavesdropper to determine the state. For these states it is also 
irrelevant whether the local agents learn if the final state is 
the result of several successful purification rounds. While in 
the purification of the initial graph state 1 0) g, this information 
(together with the knowledge of basis) would have allowed the 
local agents to exclude certain graphs (as they are not compat- 
ible with the values for correlation operators K'? calculated 



from the measurement outcomes), here the value of each cor- 
relation operator A'j' depends on the unknown, random mea- 
surement outcome of a qubit in G and hence is unknown (and 
completely random) from the point of view of the local agents 
or eavesdropper. Hence, one can in this case deliver only a 
single copy of the state to the end-users (thereby revealing 
that this copy is the result of several successful purification 
rounds) as well as only combine copies resulting from a pre- 
vious successful purification step without compromising se- 
curity of the protocol. 

The only possibility left to the eavesdropper to gain infor- 
mation about the graph is the indirect attack outlined in de- 
scription of protocol (ii). Sec. IIII Bl That is. Eve may ad- 
just the noise in channels and local operations in such a way 
that only certain states can be purified (group 1), while oth- 
ers can not (group 2). From the fact whether the purification 
protocol was successful or not, one bit of information about 
the graph could be obtained in this way (namely whether the 
graph belongs to group 1 or 2). However, this approach nec- 
essarily forces Eve to modify channel noise and/or noise in 
local control operations, which can be detected by the central 
party C. To this aim, C uses an enhanced validation procedure 
which in this case serves not only to guarantee the fidelity of 
the states to be purified, but is aimed to detect any possible 
attempts of the eavesdropper to modify the noise processes. 
This can be done e.g. by sending parts of maximally entan- 
gled states as probe states at certain instances instead of mul- 
tipartite states to be purified (the position of these probe states 
remains unknown to eavesdropper). Measurements of observ- 
ables ax and a, — which occur naturally in the purification 
protocol — can be used to perform channel tomography (at 
early instances of the protocol) and process tomography (at 
later stages of the protocol) and hence to detect any attempts 
of the eavesdropper to increase noise. Note that it is sufficient 
to send parts of maximally entangled state through channels to 
perform complete channel tomography |2Q]. Measurements 
of the two observables are sufficient in this case, as additional 
basis changes (and hence effective measurements of other ob- 
servables) can be enforced by C at the local agents during 
the initial channel depolarization. Local agents can in this 
case not distinguish whether the requested unitary operations 
corresponds to channel depolarization procedure or to a real 
basis change. The procedure is aborted if anything is not as 
expected (i.e. additional noise in channels or local operations 
occurred), even if the purification of |0)q was successful. 

Alternatively (or additionally), G may prepare and purify 
not only the enlarged graph state |0)q, but also several copies 
of other graph states \0)qi corresponding to different graphs 
G' (with different threshold values). The positions of these 
states are randomly chosen. In the validation step G checks if 
the purification of these probe states was successful. This al- 
lows G to draw conclusions about attempts of Eve to introduce 
additional noise and eventually to abort the procedure. We re- 
mark that one typically has a hierarchy of states with respect 
to their fragility to noise. That is, if the purification of a cer- 
tain state was successful, one can conclude that also several 
other states (corresponding to different graphs) are purifica- 
ble. In particular, G can be sure that Eve cannot distinguish 
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between the graph G and any graph G" for which purification 
succeeded. We remark that the same procedure can also be 
used in the context of protocol (ii). 

IV. SUMMARY AND CONCLUSIONS 

The purified states, created by one of the procedures (i), 
(ii), (iii) serve as a resource for a variety of (security) tasks. 
Graph states are for instance an algorithmic specific resource, 
i.e. depending on which state is produced a different quan- 
tum algorithm can be applied by a simple sequence of local 
measurements Other possible applications include se- 
cure evaluation of a (secret) function, secret sharing among 
some of the parties and multipartite voting schemes. The tasks 
that can be performed strongly depend on the structure of the 
graph state being produced, and thus remain unknown to any 



outsider party. 

We have introduced the distribution of an unknown multi- 
partite entangled state with high fidelity as a basic quantum 
primitive, which can be accomplished in a real-world sce- 
nario where quantum channels as well as local control oper- 
ations are noisy. We have presented three alternative ways to 
achieve this aim, based on channel purification and teleporta- 
tion or direct multipartite entanglement purification, respec- 
tively. While the first approach is conceptually simpler, the 
second and third offer advantages with respect to reachable 
fidelities and tolerable errors. 
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